December 2003 - cypherpunks-legacy

(fwd) Re: BATF raid in North Carolina
by Jim choate 17 Dec '03

17 Dec '03

Newsgroups: rec.models.rockets Path: bga.com!news.sprintlink.net!uunet!psinntp!psinntp!news From: ralphpepper(a)lesueloc.com Subject: Re: BATF raid in North Carolina Content-Type: TEXT/PLAIN; charset=US-ASCII Message-ID: <1994Jul27.031907.6182(a)nntpxfer.psi.com> Sender: news(a)nntpxfer.psi.com Organization: Performance Systems Int'l X-Newsreader: NEWTNews & Chameleon -- TCP/IP for MS Windows from NetManage References: <J+7xDKE.countdownhob(a)delphi.com> Mime-Version: 1.0 Date: Wed, 27 Jul 1994 05:49:26 GMT Lines: 61 Re: > Rebecca Rohan <rrohan(a)eskimo.com> writes: > > >Yo, those of you in rec.models.rockets who are whining about the > >crosspost --- you are one action/adventure movie away from the same > >treatment or worse. > > Rebecca, > > I, for one, appreciate the information you're providing. Too many average > citizens have no idea what's going on with federal agencies. Unconstitutional > power grabs are getting bigger and more frequent all the time. If it isn't > stopped soon, we will be stopped dead in our > tracks as a free nation. > > COUNTDOWN HOBBIES > 3 P.T. Barnum Square > Bethel, CT 06801-1838 > 203-790-9010 > Kevin Nolan > NAR 16148; TRA 0943 > CTRA/NARCONN > I currently don't have any HPR motors, reloads or any such thing. I left them behind when I moved to Georgia (not knowing the legal climate down here). So I feel (relatively) safe putting forth my two cents worth as to what I would do. First, I would be rigidly legal in every respect. In fact, after hearing about them worrying about casing residue I would make sure I didn't even have so much as a spent D12-0 casing. Anything I needed would be bought enroute to any launch meet, or at the meet itself. Second, I would endeavor to be as 'safe' and 'peaceful' as possible. There would be no 'terminator 2' talk out of me. Third, if I did get attacked, everything would be 'yessir' and 'nossir'. Then, I would quietly go down to the federal courthouse and file a RICO Act lawsuit. RICO Act stands for Racketeer Influenced and Corrupt Organizations Act. This is what is commonly referred to as being charged with 'racketeering'. RICO allows individuals (as well as governments) to file against persons or organizations that commit three major offenses against one person or a major offense against three or more persons. One unique feature that makes it exceedingly lucrative for lawyers to take on contingency is that the awarded amount is TRIPLE the sum of all court costs, out-of-pocket costs, compensatory, and punitive damages. Certain agencies may be immune but not all of them. Also, you could argue that immunity only applies to their lawfully empowered duties and when they exceed that authority, that they are acting outside of government protection and become private citizens commiting acts against other private citizens. There was a church in California in 1979 that began moving to do something like that against the state Attorney General (Dukemajian at the time). The state was trying to take over all of that church's operations (under a law protecting charitable trusts - like United Way) Ex-Parte on the claim from six ex-members that money was being absconded with. California tried to impose their own people into that church's ruling hierarchy & even declared in open court that all churches in California thereafter belonged to the state. The threatened suit plus the outrageously gross misapplication of the law spooked the California legislature into repealing that law completely over the violent protestations of Attorney General Dukemajian. I believe there was a book about this called "Against the Gates of Hell" or something by somebody named Rader.

1 0

RE:
by Blanc Weber 17 Dec '03

17 Dec '03

From: David K. Merriman It has been brought up on the Cypherpunks mailing list that Microsoft is proposing to include public-key escrow as a *built-in* "function" of future products - Chicago and Daytona have been specifically mentioned. ...................................................................... .......... No, this is not correct. It was speculation from Tim May on possible developments, based on his interpretation of recent events and on email which I sent to him. This email was referring to the fact that his concerns notwithstanding, it is not an easy thing to implement a privately-held key escrow system into a desktop operating system, that Microsoft is not talking about implementing a 'software Clipper', and is presently only *examining* the international ramifications of software key-escrow and non-escrowed strong encryption security. Please give it this question the benefit of the doubt and postpone your conclusions about this until I can get an official statement, thanks. Blanc

3 2

RE: Questions about Microsoft and Software Key Escrow
by Blanc Weber 17 Dec '03

17 Dec '03

From: Jacob Levy I respect your feelings on the matter and your ability to think clearly and with great foresight also :-), but for this list it would probably be much more useful if we got some _OFFICIAL_ answer from Microsoft instead of your "I believe, I cannot think, can't see", etc. etc. You're obviously a concerned individual but you equally obviously don't claim to speak for Microsoft. ................................................ Thanks, Jacob. I don't speak for Microsoft, but I can speak based on impressions I have accumulated from internal correspondence between employees and misc. company communications to employees. The company would suffer turmoil from within, if it were the case that privacy had been compromised. Programmers are just like you & me, right? Anyway, I personally can't see the very existence of a system of key escrow is an evil which should be apprehended and stopped. In concert with the idea of liberty & freedom to develop ideas and export crypto, I think the best offense is a good defense. I would oppose the idea that anyone should be stopped from developing creative ideas on the principle that it would be contrary to the existence of intelligence on the planet. I would oppose it if the government promoted it, and I would oppose it if any one else did, also. Blanc

2 1

Re: Questions about Microsoft and Software Key Escrow
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

ironically. Instead, he just confirmed to me via his arguments that some kind of SKE scheme is being talked about, negotiated with one or more federal agencies, and may or may not be planned for future products. is Mr Gnu reading this? I think it's time another FOIA request was in order... G (who doesn't usually expect other people to do stuff that he could do himself, it's just that I don't think they'd look kindly on an FOIA request from Scotland ;-) )

1 0

New Threat on the Horizon: Software Key Escrow
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

At the June Cypherpunks meeting, Whit Diffie (co-inventor of public-key crypto, as you should all know) filled us in on a workshop on "key escrow" held in Karlsruhe, Germany. All the usual suspects were there, and I gather that part of the purpose was to bring the Europeans "into the tent" on key escrow, to deal with their objections to Clipper, and so on. Diffie described in some detail a software-based scheme developed by NIST (and Dorothy Denning, if I recall correctly) that, as I recall the details, avoids public key methods. Perhaps this was also described here on the list. I know Bill Stewart has recently discussed it in sci.crypt or talk.politics.crypto. What has me worried about it now is evidence from more than one source that this program is actually much further along than being merely a "trial balloon" being floated. In fact, it now looks as though the hardware-based key escrow systems will be deemphasized, as Al Gore's letter seems to say, in favor of software-based schemes. While I've been skeptical that software-based schemes are secure (the bits are hardly secure against tampering), the addition of negotiation with another site (a lot like online clearing of digital cash, it seems) can make it nearly impossible for tampering to occur. That is, I'm now more persuaded that the NIST/NSA(?) proposal would allow software-based key escrow. Here's the rub: * Suppose the various software vendors are "incentivized" to include this in upcoming releases. For example, in 30 million copies of Microsoft's "Chicago" (Windows 4.0) that will hit the streets early in '95 (betas are being used today by many). * This solves the "infrastructure" or "fax effect" problem--key escrow gets widely deployed, in a way that Clipper was apparently never going to be (did any of you know _anybody_ planning to buy a "Surety" phone?). (Granted, this is key escrow for computers, not for voice communication. More on this later.) * Once widely deployed, with not talk of the government holding the keys, then eventual "mandatory key escrow" can be proposed, passed into law by Executive Order (Emergency Order, Presidential Directive, whatever your paranoia supports), an act of Congress, etc. I don't claim this scenario is a sure thing, or that it can't be stopped. But if in fact a "software key escrow" system is in the works, and is more than just a "trial balloon," then we as Cypherpunks should begin to "do our thing," the thing we've actually done pretty well in the past. To wit: examine the implications, talk to the lobbyist groups about what it means, plan sabotage efforts (sabotage of public opinion, not planting bugs in the Chicago code!), and develop ways to make sure that a voluntary key escrow system could never be made mandatory. (Why would _anyone_ ever use a voluntary key escrow system? Lots of reasons, which is why I don't condemn key escrow automatically. Partners in a business may want access under the right circumstances to files. Corporations may want corporate encryption accessible under emergencyy circumstances (e.g., Accounting and Legal are escrow agencies). And individuals who forget their keys--which happens all the time--may want the emergency option of asking their friends who agreed to hold the key escrow stuff to help them. Lots of other reasons. And lots of chances for abuse, independent of mandatory key escrow.) But there are extreme dangers in having the infrastructure of a software key escrow system widely deployed. I can't see how a widely-deployed (e.g., all copies of Chicago, etc.) "voluntary key escrow" system would remain voluntary for long. It looks to me that the strategy is to get the infrastructure widely deployed with no mention of a government role, and then to bring the government in as a key holder. (The shift of focus away from telephone communications to data is an important one. I can see several reasons. First, this allows wide deployment by integration into next-gen operating systems. A few vendors can be "incentivized." Second, voice systems are increasingly turning into data systems, with all the stuff surrounding ISDN, cable/telco alliances, "set-top" boxes, voice encryption on home computers, etc. Third, an infrastructure for software key escrow would make the backward extension to voice key escrow more palatable. And finally, there is a likely awareness that the "terrorist rings" and "pedophile circles" they claim to want to infiltrate are more than likely already using computers and encryption, not simple voice lines. This will be even more so in the future. So, the shift of focus to data is understandable. That it's a much easier system in which to get 40-60 million installed systems _almost overnight_ is also not lost on NIST and NSA, I'm sure.) In other words, a different approach than with Clipper, where essentially nobody was planning to buy the "Surety" phones (except maybe a few thousand) but the government role was very prominent--and attackable, as we all saw. Here, the scenario might be to get 40-60 million units out there (Chicago, next iteration of Macintosh OS, maybe Sun, etc.) and then, after some series of events (bombings, pedophile rings, etc.) roll in the mandatory aspects. Enforcement is always an issue, and I agree that many bypasses exist. But as Diffie notes, the "War on Drugs" enlistment of corporations was done with various threats that corporations would lose assets/contracts unless they cooperated. I could see the same thing for a software-based key escrow. A potentially dangerous situation. I was the one who posted the Dorothy Denning "trial balloon" stuff to sci.crypt, in October of 1992, six months before it all became real with the announcement of Clipper. This generated more than a thousand postings, not all of them useful (:-}), and helped prepare us for the shock of the Clipper proposal the following April. I see this software-based key escrow the same way. Time to start thinking about how to stop it now, before it's gone much further. Putting Microsoft's feet to the fire, getting them to commit to *not* including any form of software-based key escrow in any future releases of Windows (Chicago or Daytona) could be a concrete step in the right direction. Ditto for Apple. I'm sure we can think of other steps to help derail widespread deployment of this infrastructure. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway." -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

5 5

(fwd) Possible compromise of anon.penet.fi
by nzook＠math.utexas.edu 17 Dec '03

17 Dec '03

Path: math.utexas.edu!news.dell.com!tadpole.com!uunet!spool.mu.edu!howland.reston.ans.net!gatech!news-feed-1.peachnet.edu!news.duke.edu!eff!news.kei.com!hermes.oc.com!convex!cnn.eng.convex.com!barnett From: barnett(a)convex.com (Paul Barnett) Newsgroups: alt.privacy Subject: Possible compromise of anon.penet.fi Date: 27 Jul 94 22:09:28 GMT Organization: CONVEX News Network, Engineering (cnn.eng), Richardson, Tx USA Lines: 29 Message-ID: <barnett.775346968(a)cnn.eng.convex.com> NNTP-Posting-Host: zeppelin.convex.com Someone has been collecting email addresses, apparently from postings to Usenet, and forging them to anonymous postings through anon.penet.fi to alt.test. The text of the posting states the REAL email address of the poster, under a posting attributed to the anonymous ID assigned to that poster. I received a notification that an anonymous ID has allocated for me, followed by a confirmation of a posting to alt.test. Looking in alt.test, you will see as many as 500 similar postings. Most of the anonymous IDs are numbered sequentially. However, there are some lower numbered anonymous IDs, presumably in previous use by the addressee named in the text of the message. These anonymous addresses are now compromised. I am posting to this newsgroup because there appears to be some correlation between the contributers to this newsgroup and the addresses that were forged to the messages. It may be coincidental, but I thought this was a fair place to post a warning anyway. My condolences to those people that have been caught in this net. This is one of the most despicable forms of net.terrorism that I have encountered. -- Paul Barnett Convex Computer Corp. MPP OS Development Richardson, TX

2 1

Denning and Walker on SKE and International Escrow
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Somebody (who can speak up if he wants to) sent me this advance program...looks like deja vu all over again. I've elided all the talks other than those of interest to this debate. > International Cryptography Institute 1994: Global Challenges > > September 22-23, 1994 > Ritz Carlton, Washington, DC > > Presented by > The National Intellectual Property Law Institute > >The International Cryptography Institute will focus on problems and >challenges associated with the use of cryptography within nations and >for international communications. The Institute will address such >questions as: What are the different national policies and regulations >governing cryptography and how might these evolve? What cryptographic >technologies are on the market in different countries, what is being >used, and what is it being used for? What problems is cryptography >causing law enforcement? What are the requirements of businesses and >other organizations? What are the new trends in cryptography and what >will be their impact on society? What efforts are leading toward an >international cryptography framework? The Institute is for government >officials, industry leaders, policy makers and analysts, researchers, >and users of cryptographic technologies. > >8:45-9:00 Opening Remarks >Dorothy E. Denning, Chair of Program >James Chandler, President, National Intellectual Property Law Institute ... >4:00-4:30 >Experiments in International Cryptography and Software Key Escrow >Stephen T. Walker, Trusted Information Systems, Inc. > >4:30-5:00 >International Escrowed Encryption >Dorothy E. Denning, Georgetown University >John Droge, Mykotronx, Inc. ... >11:30-12:00 >World-Wide Availability of Cryptography Products >David Balenson, Trusted Information Systems, Inc. > >12:00-1:30 Lunch with Keynote >Louis J. Freeh, Director, Federal Bureau of Investigation (invited) Actually, all the other papers deal with the same ball of wax...it looks like some serious discussions about "the legitimate needs of law enforcement" and whatnot have *already occurred*. My guess is that key escrow is already part of the New World Order (not to sound like a conspiracy theorist) and that's why the export folks are making comments to software companies about key escrow. One big happy police state. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 1

Re: Local Cypherpunks (?) group
by donald goldhamer 17 Dec '03

17 Dec '03

>Is there any interest in establishing a local (Chicago area) equivalent of >the bay area Cypherpunks which meets in physical (as opposed to cyberspace ) >form. Topics to be addressed include issues of privacy, security, >cryptography and .... Since the Chicago chapter of CPSR (Computer Professionals for Social Responsibility) has decided to develop a project (public education, etc.) in the area of privacy (among others), it would seem to me to be more productive to work with them. Donald H. Goldhamer d-goldhamer(a)UChicago.EDU Academic Information Technologies 312-702-7166; fax: 312-702-3219 University of Chicago, Culver Hall 206, 1025 E 57th St, Chicago IL 60637

2 1

DES Vulnerable, Why?
by KentBorg＠aol.com 17 Dec '03

17 Dec '03

It seems the TLAs (in a weak moment) let slip that DES was getting old and creaky and vulnerable. The story is that that is what sent the TLAs off on their search for a new encryption standard. (Unfortunately, they got their mission reversed and decided the need was to *read* plaintext not encrypt it.) My question: if triple-DES is so damn tough to break, what is wrong with DES? Triple-DES is a trivial variation on DES. Is it likely that DES's frailities are not the ones we compute with all those big numbers? Given the public portions of DES's history, what DES weaknesses make sense? -kb, the Kent who is 300+ emails behind due to a biz trip and a damp notebook. -- Kent Borg +1 (617) 776-6899 kentborg(a)world.std.com kentborg(a)aol.com Proud to claim 39:30 hours of TV viewing so far in 1994!

4 3

Just say NYET to censors
by nzook＠math.utexas.edu 17 Dec '03

17 Dec '03

Copyright 1994, Nathan Zook. All rights reserved. Intelectual copyrights pending. NYET-- Non-Youths Exhibit Temperance. Before I start, it may be informative to consider that I consider myself to be a hard-line member of the Christian Conservative movement, and a hard- line advocate of electronic privacy. I am a PhD candidate in mathematics at the University of Texas of Austin, and I got the Electronic Privacy language added to the 1994 Republican Party of Texas platform. I am a member of Trinty Evangelical Free Church, and am twenty-seven years old. As the Internet community continues to grow, the differences of conviction that exists generally in the world find their way into the community. Some demand that newcomers to the net adapt to the mores of this society. Some demand that the net, as a newcomer to the world, adapt to the outside. As recent events have demonstrated, the less reasonable, on both sides, may be endangering the integrity and availablity of the net. Calls for net censorship, it may be expected, will continue to grow unless the net can find some way to police itself. Yet "police itself" is a term that sends the net into fits. My solution, NYET, is for the appropriate users to directly censor the data that they might legitmately lay claim to censoring--data that flows to minors over which they have legal authority and responsibility. Specifically, this is a plan to create two sorts of accounts to the net-- adult and minor. Adult accounts may only be obtained by persons of age eighteen. Minor accounts may only be obtained as adjuncts to adult accounts, refered to as supervisor accounts. Adult accounts would have full access to anything on the net. News readers, telnet, ftp and like software being operated from a minor account would check a file in the adult account to allow access. Newsreaders, in particular, would censor any posts crossed from a non-allowed account. The control files in the supervisory accounts would default to allow-only mode, but could be selected to deny-only. The legal framework that I see important in aiding such a system is as follows: State Level: 1) Declare to hold harmless those BBS operators for charges of Contributing to the Delinquacy of a Minor that obtain and verify the age of account holders, and maintain a NYET system of access for minors. Certain acceptable verification methods specified, with authority to add methods delegated to a regulatory agency. Emphasis to be on ease and speed of verification. Special consideration for in-house systems. 2) Make it illegal to misrepresent age and name data to a BBS. Require BBS operators to maintain a record of age and name of account holders for thirty days after opening of account for hold harmless agreement, and allowing deletion of said data afterwards. 3) Declare aiding in tampering with NYET system to be "Contributing to the Delequency of a Minor". Federal Level: Pass paralell laws for BBSs operating with local numbers from two or more states, or for BBSs operating with 800 numbers. I believe that such a system would protect the full free expression currently enjoyed by the net, while reaffirming parental responsibility in the upbringing of their children. The burden of controlling access devolves all the way to the parents, making charges against BBS operators patently frivolous. Porno charges would then be MUCH more difficult to press, since a jury could be told that specific steps were being taken to prevent access to minors. If parents complained that they didn't want to go to the trouble of spelling out what their children could access, the response is clear: "Oh, so it's not worth the effort to you?" Despite slurs in this group to the contrary, I believe that the proposed us.* heirarchy may well be the first in a series of attempts to censor the net. Remember, we already have had a censor for TV, movies, and radio. It is not really a question of _if_ but _who_ and at _what level_ will this censoring take place. Nathan (Adjusting flame gear)

7 7